module Authorization (
        Role(..),
        Clearance(rolesMayAllow, rolesMustDeny,
                  clearanceCheck, secureFunction),
    ) where

import List

data Role = Role String
    deriving(Show,Read,Eq)

class Clearance a where
    rolesMayAllow :: a -> [Role]

    rolesMustDeny :: a -> [Role]
    rolesMustDeny a = []

    clearanceCheck :: a -> [Role] -> Bool
    clearanceCheck c rs = (&&)
            (      null $ intersect rs $ rolesMustDeny c)
            (not $ null $ intersect rs $ rolesMayAllow c)

    secureFunction :: a -> b -> [Role] -> Maybe b
    secureFunction c f rs = check' $ clearanceCheck c rs where
        check' True  = Just f
        check' False = Nothing

